Python volatility.obj.VolatilityMagic() Examples

The following are 22 code examples of volatility.obj.VolatilityMagic(). You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may also want to check out all available functions/classes of the module volatility.obj , or try the search function .
Example #1
Source File: windows.py    From vortessence with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #2
Source File: windows.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def modification(self, profile):
        signature = '\x00\x00\x00\x00\x00\x00\x00\x00' if profile.metadata.get('memory_model', '32bit') == '32bit' else '\x00\xf8\xff\xff'
        signature += 'KDBG' + struct.pack('<H', self.kdbgsize)
        profile.merge_overlay({'VOLATILITY_MAGIC': [ None, {
                                'KDBGHeader': [ None, ['VolatilityMagic', dict(value = signature)]]
                                                            }
                                                    ]})
Example #3
Source File: windows.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        kwargs.pop('value', None)
        self.protected = kwargs.get("protected", False)
        self.tag = kwargs.get("tag", None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #4
Source File: windows.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #5
Source File: bigpagepools.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)

        # Save the distance argument for later
        self.distance = kwargs.get('distance', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #6
Source File: windows.py    From DAMM with GNU General Public License v2.0 5 votes vote down vote up 
def modification(self, profile):
        signature = '\x00\x00\x00\x00\x00\x00\x00\x00' if profile.metadata.get('memory_model', '32bit') == '32bit' else '\x00\xf8\xff\xff'
        signature += 'KDBG' + struct.pack('<H', self.kdbgsize)
        profile.merge_overlay({'VOLATILITY_MAGIC': [ None, {
                                'KDBGHeader': [ None, ['VolatilityMagic', dict(value = signature)]]
                                                            }
                                                    ]})
Example #7
Source File: windows.py    From DAMM with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        kwargs.pop('value', None)
        self.protected = kwargs.get("protected", False)
        self.tag = kwargs.get("tag", None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #8
Source File: windows.py    From DAMM with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #9
Source File: bigpagepools.py    From DAMM with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)

        # Save the distance argument for later
        self.distance = kwargs.get('distance', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #10
Source File: windows.py    From vortessence with GNU General Public License v2.0 5 votes vote down vote up 
def modification(self, profile):
        signature = '\x00\x00\x00\x00\x00\x00\x00\x00' if profile.metadata.get('memory_model', '32bit') == '32bit' else '\x00\xf8\xff\xff'
        signature += 'KDBG' + struct.pack('<H', self.kdbgsize)
        profile.merge_overlay({'VOLATILITY_MAGIC': [ None, {
                                'KDBGHeader': [ None, ['VolatilityMagic', dict(value = signature)]]
                                                            }
                                                    ]})
Example #11
Source File: windows.py    From vortessence with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        kwargs.pop('value', None)
        self.protected = kwargs.get("protected", False)
        self.tag = kwargs.get("tag", None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #12
Source File: bigpagepools.py    From aumfor with GNU General Public License v3.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)

        # Save the distance argument for later
        self.distance = kwargs.get('distance', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #13
Source File: bigpagepools.py    From vortessence with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)

        # Save the distance argument for later
        self.distance = kwargs.get('distance', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #14
Source File: win10.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def modification(self, profile):
        build = profile.metadata.get("build", 0)

        if build >= 18362:
            signature = "\x03\x00\xb8\x00"
        else:
            signature = "\x03\x00\xb6\x00"

        profile.merge_overlay({
            'VOLATILITY_MAGIC': [ None, {
            'DTBSignature' : [ None, ['VolatilityMagic', dict(value = signature)]],
            }]})
Example #15
Source File: windows.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def modification(self, profile):
        signature = '\x00\x00\x00\x00\x00\x00\x00\x00' if profile.metadata.get('memory_model', '32bit') == '32bit' else '\x00\xf8\xff\xff'
        signature += 'KDBG' + struct.pack('<H', self.kdbgsize)
        profile.merge_overlay({'VOLATILITY_MAGIC': [ None, {
                                'KDBGHeader': [ None, ['VolatilityMagic', dict(value = signature)]]
                                                            }
                                                    ]})
Example #16
Source File: windows.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        kwargs.pop('value', None)
        self.protected = kwargs.get("protected", False)
        self.tag = kwargs.get("tag", None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #17
Source File: windows.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #18
Source File: bigpagepools.py    From volatility with GNU General Public License v2.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)

        # Save the distance argument for later
        self.distance = kwargs.get('distance', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #19
Source File: win10.py    From aumfor with GNU General Public License v3.0 5 votes vote down vote up 
def modification(self, profile):
        profile.merge_overlay({
            'VOLATILITY_MAGIC': [ None, {
            'DTBSignature' : [ None, ['VolatilityMagic', dict(value = "\x03\x00\xb6\x00")]],
            }]})
Example #20
Source File: windows.py    From aumfor with GNU General Public License v3.0 5 votes vote down vote up 
def modification(self, profile):
        signature = '\x00\x00\x00\x00\x00\x00\x00\x00' if profile.metadata.get('memory_model', '32bit') == '32bit' else '\x00\xf8\xff\xff'
        signature += 'KDBG' + struct.pack('<H', self.kdbgsize)
        profile.merge_overlay({'VOLATILITY_MAGIC': [ None, {
                                'KDBGHeader': [ None, ['VolatilityMagic', dict(value = signature)]]
                                                            }
                                                    ]})
Example #21
Source File: windows.py    From aumfor with GNU General Public License v3.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        kwargs.pop('value', None)
        self.protected = kwargs.get("protected", False)
        self.tag = kwargs.get("tag", None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)
Example #22
Source File: windows.py    From aumfor with GNU General Public License v3.0 5 votes vote down vote up 
def __init__(self, *args, **kwargs):
        # Remove the value kwarg since overlaying one 
        # on the other would give the value precedence
        kwargs.pop('value', None)
        obj.VolatilityMagic.__init__(self, *args, **kwargs)